c9c916bbf10a5b1d0a964b037b41800eff7709c2071a05765155ed015ee46cdb

Resubmissions

22-05-2024 03:21

21-05-2024 14:47

max time kernel
1794s
max time network
1806s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:21

Target

2ab64b866f5026b8f14f1ace264934f4d35ba4b0d57dc7819d64c214dae34d42
Size

48KB
MD5

0ca9756b13379f227e6a3aeed0c278c6
SHA1

6e6f4774ff5c9f1741c276b82dddbd98f9e4a745
SHA256

c9c916bbf10a5b1d0a964b037b41800eff7709c2071a05765155ed015ee46cdb
SHA512

8c69dffd9a4fca58502a77e1ccf5960b6edfb006a47de20ed31af0d926fb5c46ee9981156e485fc14e572abd13826c7e8690ca60bf9d4c9d40ab79b5319d69a7
SSDEEP

384:oWYm4Hc3jGYJtpaIg7k6yXprPHJSi0Z8jRulSNtgTYFlINvsQ9jxCFeoO0OhR:4HcjhL8dWrVmY8lEtT+sZO

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 3792 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	3792	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2ab64b866f5026b8f14f1ace264934f4d35ba4b0d57dc7819d64c214dae34d42
1⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3952 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4200

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3792

memory/3792-0-0x00000198F7C40000-0x00000198F7C50000-memory.dmp

Filesize
64KB

Download
memory/3792-16-0x00000198F7D40000-0x00000198F7D50000-memory.dmp

Filesize
64KB

Download
memory/3792-32-0x00000198801F0000-0x00000198801F1000-memory.dmp

Filesize
4KB

Download
memory/3792-36-0x0000019880330000-0x0000019880331000-memory.dmp

Filesize
4KB

Download
memory/3792-35-0x0000019880220000-0x0000019880221000-memory.dmp

Filesize
4KB

Download
memory/3792-34-0x0000019880220000-0x0000019880221000-memory.dmp

Filesize
4KB

Download